valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update win_rare_service_installs.yml

Browse Source 
same count() by ServiceFileName < 5 aded to make sigmac work with elastalert integration
This commit is contained in:
Roberto Rodriguez 2018-12-05 05:33:56 +03:00
parent f0b23af10d
commit c8990962d2
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
rules/windows/builtin/win_rare_service_installs.yml
View File

@ -13,8 +13,8 @@ detection:
selection:
EventID: 7045
timeframe: 7d
condition: selection | count(ServiceFileName) < 5
condition: selection | count() by ServiceFileName < 5
falsepositives:
- Software installation
- Software updates
level: low
level: low